Security
How we keep XFree secure for all users.
Our Security Approach
XFree is built with security as a core principle. Since all tool processing happens client-side in the browser, the attack surface is significantly reduced compared to server-side processing.
Client-Side Processing
Every published tool processes data entirely in your browser. No server receives your data, reducing exposure to network attacks.
HTTPS Only
All XFree traffic is encrypted via HTTPS. We use modern TLS versions and strong cipher suites.
No Data Storage
We do not store tool inputs, outputs, or user data on our servers. Your data exists only in your browser session.
Minimal Dependencies
We keep third-party JavaScript to a minimum to reduce potential supply chain vulnerabilities.
Content Security Policy
Every page ships with a strict Content-Security-Policy, Cross-Origin-Opener-Policy, Cross-Origin-Embedder-Policy, and X-Content-Type-Options header to limit what scripts and resources can execute or load, even in the event of an injection attempt.
Web Crypto API
Hashing and cryptographic tools (SHA-256, HMAC, and similar) use the browser's native Web Crypto API rather than a third-party JavaScript crypto library, so the primitives are implemented and audited by the browser vendor, not by us.
No AI Backend, Today
Every tool currently published on XFree is Local Mode only - none of them transmit input data to an AI backend or any other external service. If that changes for a future tool, it will be clearly marked with a privacy notice on that specific tool's page before you use it.
⚠️ Responsible Disclosure
If you discover a security vulnerability, please contact us through our contact form. We appreciate responsible disclosure and will work to address issues promptly.